The UAE's first federal personal data protection law. It sets lawful-basis, consent, purpose limitation, security, breach notification and data subject rights requirements for controllers and processors in the UAE and for those processing UAE residents' data from abroad, supervised by the UAE Data Office. Government data, the DIFC and ADGM, and health and banking data are excluded.
Federal Decree-Law No. 45 of 2021 is the UAE's first federal personal data protection law. It came into force on 2 January 2022 (Article 31) and is in force, but its full operation depends on Executive Regulations that Article 28 required the Cabinet to issue within six months of promulgation and that have not yet been published on the legislation portal; Article 29 gives controllers and processors six months from the issue of those regulations to comply, extendable once. Article 26 leaves administrative penalties to a Cabinet decision, so the law currently sets duties without a published fine schedule.
Article 2 applies the law to the processing of personal data by automated or other means where the data subject resides or has a place of business in the UAE, where the controller or processor resides in the UAE, and to every controller or processor residing outside the State that processes data of people inside it. It excludes government data and government entities, data held by security and judicial authorities, purely personal use by an individual, health data and personal banking and credit data that have their own laws, and entities in free zones that have their own data protection legislation, which in practice means the DIFC and ADGM.
Article 4 prohibits processing without the data subject's consent except in listed cases such as performance of a contract, legal claims, data the person has made public and protection of the person's interests. Article 5 sets the principles: fair, transparent and lawful processing for a specific purpose, limited to what is necessary, accurate, secured and not kept longer than needed unless anonymised. Article 6 requires consent to be provable, clear and as easy to withdraw as to give.
Article 7 requires controllers to apply security and privacy measures and data-minimisation defaults, keep a record of processing and appoint only processors that give sufficient guarantees; Article 8 confines processors to the controller's instructions. Article 9 requires the controller to notify the UAE Data Bureau at the time it becomes aware of a breach that prejudices privacy or security, and to notify the affected data subjects. Article 10 requires a data protection officer for high-risk new technology, systematic assessment of sensitive data or large-scale sensitive data. Article 20 requires security measures such as encryption and pseudonymisation, and Article 21 an impact assessment before high-risk processing.
Articles 13 to 18 give data subjects rights of access, portability, correction and erasure, restriction, objection to direct marketing and objection to automated decisions, with human review on request. Articles 22 and 23 allow cross-border transfers to countries with adequate law approved by the Bureau, or otherwise under contractual safeguards, explicit consent, legal claims or contract performance. Articles 24 and 25 provide for complaints to the Bureau and a 30-day grievance to its General Director before any court challenge.
Any controller or processor established in the UAE outside the DIFC and ADGM, and any controller or processor abroad processing personal data of people inside the UAE; data subjects resident or doing business in the UAE. Excluded: government entities and data, security and judicial data, purely personal use, health and personal banking data under their own laws, and free zones with their own data protection law.
| Article 2 | Applies to processing by automated or other means where the data subject or the controller or processor is in the UAE, and to controllers or processors outside the State processing data of people inside it; excludes government, security and judicial data, personal use, health and personal banking data with their own laws, and free zones with their own data law. |
| Article 4 | Processing without the data subject's consent is prohibited except in listed cases such as contract performance, legal claims, public-interest purposes, data the person has made public and protecting the person's interests. |
| Article 5 | Processing must be fair, transparent and lawful, for a specific purpose, limited to what is necessary, accurate and up to date, secured, and retained no longer than needed unless anonymised. |
| Article 6 | The controller must be able to prove consent; consent must be clear, simple and accessible, and as easy to withdraw as to give, without affecting earlier processing. |
| Articles 7–8 | Controllers must apply security and privacy measures, data-minimisation defaults, keep a processing record and appoint only processors with sufficient guarantees; processors act only on the controller's instructions under a written contract and delete data at the end. |
| Article 9 | The controller must notify the UAE Data Bureau at the time it becomes aware of a breach that prejudices privacy or security, and notify affected data subjects; processors must alert the controller as soon as they become aware. |
| Article 10 | A data protection officer, internal or external, is required where processing involves high-risk new technology or large volumes, systematic assessment of sensitive data including profiling, or large-scale sensitive data. |
| Articles 13–18 | Data subject rights: information and access, portability of consent- or contract-based automated data, correction and erasure, restriction, objection to direct marketing, and objection to automated decisions including profiling with human review on request. |
| Articles 20–21 | Technical and organisational security measures suited to the risk, including encryption, pseudonymisation, resilience and restoration, and a data protection impact assessment before high-risk processing. |
| Articles 22–23 | Cross-border transfers are allowed to jurisdictions with adequate law and an enforcing authority as approved by the Bureau, or otherwise under contractual safeguards, explicit consent, legal claims, contract performance or public interest. |
| Articles 24–26 | Complaints go to the Bureau, grievances against its decisions to the General Director within 30 days with a decision within 30 days, and administrative penalties are to be set by the Cabinet on the Bureau's proposal. |
| Articles 28–31 | Executive Regulations were due within six months of promulgation; controllers and processors have six months from their issue to comply, extendable once; the Decree-Law came into force on 2 January 2022. |
The Decree-Law contains no fine schedule. Article 26 provides that the Cabinet, on the Bureau's proposal, will define the violations and the administrative penalties for them; Article 24 lets the Bureau investigate complaints and impose those penalties once set. Criminal exposure for data misuse sits separately in Articles 6 and 13 of the Cybercrime Law.
Every company we form holds personal data about shareholders, directors, employees and customers, and we hold KYC files on all of them ourselves, so this law governs both sides of the relationship. Our own privacy notice, retention schedule and processor contracts follow Articles 5 to 9, and because we process AML data under a legal obligation we document that basis rather than relying on consent. For clients we check whether their activity triggers a data protection officer or impact assessment under Articles 10 and 21, which is common for platforms, marketing businesses and anyone profiling users, and we build a breach-response step into their compliance calendar. Where a client sits in the DIFC or ADGM we apply those centres' own data protection laws instead, and where a group transfers data between a UAE entity and a foreign parent we document an Article 23 basis, usually contractual safeguards, pending the Bureau's adequacy list.
Cybercrime Law
The UAE cybercrime law, replacing the 2012 law. It criminalises unauthorised access to systems and data, electronic fraud and forgery, online defamation, spreading rumour…
DIFC Data Protection Law
GDPR-aligned statute replacing the 2007 law: it sets lawful bases for processing, data subject rights, controller and processor duties, breach notification, data protecti…
ADGM Data Protection Regulations
GDPR-style regime administered by the ADGM Office of Data Protection: data-protection principles, individual rights, controller and processor duties, data protection offi…
DIFC Data Protection Regulations
Made under the Data Protection Law 2020, the Regulations detail records of processing, notifications to the Commissioner, complaints, fines, personal data breaches, digit…
Electronic Transactions and Trust Services Law
Replaces the 2006 e-commerce law: electronic documents, signatures and seals cannot be denied legal effect merely because they are electronic; trust service providers mus…
AML/CFT/CPF Law 2025
The UAE's principal AML law in 42 articles. It criminalises money laundering, terrorism and proliferation financing, imposes risk assessment, customer due diligence, reco…
Whether you are establishing a new venture, restructuring an existing enterprise, or exploring residency pathways — we are here to advise.
Arrange a Consultation →